<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2975524&amp;fmt=gif">
BLOG

7 reasons why you shouldn’t choose SPAN as a real visibility access device

May 24, 2018

TAP vs SPAN Garland Technology

Every day I come across network techs who continue to rely on SPAN ports for their network access method.  This blows my mind as its been proven time and again why you shouldn’t rely on SPAN ports. Let me share with you some of those reasons why:

First - Spanning or mirroring changes the timing of the frame interaction (what you see is not what really happened).

Second - The spanning algorithm is not designed to be the primary focus or the main function of the device like switching or routing, so the first priority is not spanning and if replicating a frame becomes an issue, the hardware will temporally drop the SPAN process resulting in dropped frames and timing that is way off.

Third - If the load on the bus of the SPAN port becomes overloaded frames are just dropped along with all frames that are corrupted in any way.

 

>> Download Now: TAP vs SPAN [Free whitepaper]

 

Fourth – Proper spanning requires that a network engineer configure the switches properly through Line Code and this takes away from the more important tasks that network engineers have. Many times configurations can become a political issue (constantly creating contention between the IT team, the security team and the compliance team).

Fifth – A SPAN port drops all packets that are corrupt, those that are below the minimum size or oversized, so all frames are not passed on. All of these events can occur and no notification is sent to the user, so there is no guarantee that one will get all the data required for proper analysis. Corrupted CRC frames can come from many issues and they are important to know.

Sixth - A SPAN port is not a passive visibility technology. Some may say that SPAN port access is a passive data access solution – but passive means “having no effect”. However  spanning (mirroring) does have measurable and non-repeatable/variable effect on the data that is delivered to analysis and storage equipment.

Seventh - SPAN ports are not a scalable technology. With Gigabit, 10 Gigabit and up technologies the maximum bandwidth is now twice the base bandwidth – so a Full Duplex (FDX) Gigabit link is now 2 Gigabits of data and a 10 Gigabit FDX link is now 20 Gigabits of potential data (– InterFrame gaps).

No switch or router can handle replicating/mirroring all this data plus handling its primary job of switching and routing. It is difficult if not impossible to pass all frames (good and bad one) including FDX traffic at full time rate, in real time at non blocking, no loss speeds.

In summary, the fact that SPAN port is not a passive data visibility access technology, or even entirely non-intrusive can be a problem particularly for data security and compliance monitoring or lawful intercept. Since there is no guarantee of absolute fidelity, it is likely that evidence gathered by this monitoring process will be challenged in the court of law.

Looking to add a visibility solution to your next deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do!

New call-to-action

See Everything. Secure Everything.

Contact us now to secure and optimized your network operations
Contact Us

Heartbeats Packets Inside the Bypass TAP

If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.

If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.

While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.

Some of you may have noticed a flaw in the logic behind this solution!  You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.

Glossary

  1. Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.

  2. Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.

  3. Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.

NETWORK MANAGEMENT | THE 101 SERIES